Add backups, token expiry warnings and name server checks

- Daily database backups: jarl-backup.timer runs 'jarld backup', which
  writes jarl-<UTC time>.db into backup.dir, checks it before naming it,
  and prunes by the time in the name while always keeping the newest
  keep_at_least. New backup: section in jarl.yaml; the dashboard and
  'jarl status' show the newest backup and warn when it is stale or
  failed. The Debian package enables the timer.
- 'jarld restore [FILE | latest]': checks the backup, shows it next to
  the current database, keeps the current one aside and records the
  restore. 'jarld serve' holds a database lock, so a restore can't run
  under a live jarld and two jarlds can't share a database.
- Token expiry warnings from 14 days ahead: dashboard, token lists, a
  daily log line, and a CLI warning via the Jarl-Token-Expires header;
  'jarl token list --expiring'.
- 'jarl zone serials' and the zone page's Name servers tab: compare the
  serial on a primary zone's secondaries (NS records, also-notify) or a
  secondary zone's primaries with this server's.
- 'jarl zone delegation': for zones on the internet, check the parent's
  delegation and glue against the zone; an undelegated zone gets a note.
- Server: Jarl/<version> header; CLI exit code 2 for failed checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/permissions.md

@@ -114,6 +114,25 @@ jarl token revoke 12
 In the web UI: Account → API tokens (your own) and Users → *user* →
 Tokens (admin).
 
+### Expiring tokens
+
+A token with an expiry stops working at that moment. So that it doesn't
+catch you out (a certbot token that expired breaks renewals silently, until
+the certificate itself expires), Jarl warns from **14 days before**:
+
+* the dashboard lists the tokens that expire soon or expired in the last 14
+  days (administrators see everyone's, others their own), and token lists
+  mark them *soon* or *expired*;
+* jarld logs a warning once a day for each of them;
+* every response to such a token carries a `Jarl-Token-Expires` header,
+  and the `jarl` CLI prints a warning on stderr when it sees it, so the
+  logs of the script using the token show it;
+* `jarl token list --all --expiring` lists them (`--expiring 60d` looks
+  further ahead).
+
+Rotating the token (below) gives it a new lifetime, and keeps its
+permissions.
+
 ### Rotating a token
 
 Rotating gives a token a **new secret** and changes nothing else: it keeps